fix(network): harden additional CA propagation

Signed-off-by: Jesse Jaggars <jjaggars@redhat.com>

Author: jhjaggars

.rpi/tasks/network-supervisor-additional-ca/01-research-questions.md

@@ -12,6 +12,14 @@ use std::fmt;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
 
+/// Maximum number of normalized PEM bytes accepted for destination trust.
+///
+/// This bound is shared by the gateway normalization boundary and all compute
+/// driver consumers. Kubernetes counts the `ca.crt` key and value toward its
+/// 1 MiB `ConfigMap` data limit, so reserve the six key bytes here to keep every
+/// supported driver on the same deployable boundary.
+pub const MAX_NETWORK_SUPERVISOR_TRUST_BUNDLE_BYTES: usize = 1024 * 1024 - "ca.crt".len();
+
 /// Normalized, gateway-owned trust material for sandbox destination TLS.
 ///
 /// The PEM bytes contain only canonical X.509 certificate blocks.  The type is

.rpi/tasks/network-supervisor-additional-ca/02-research.md

@@ -115,16 +115,30 @@ pods do not need direct external ingress for SSH.
 
 Additional sandbox destination roots use the global
 `[openshell.supervisor.network].additional_ca_cert_paths` setting rather than a
-Kubernetes driver key. Before sandbox creation, the in-process driver
-server-side-applies one normalized `ca.crt` ConfigMap named
-`openshell-network-additional-ca-<gateway-id>` in the selected shared, managed,
-or operator namespace. Combined topology mounts it only in the agent container
-that runs network supervision. Sidecar topology mounts it only in
-`openshell-network`; workload and init containers do not receive it. Both use
-the read-only `/etc/openshell-tls/network-additional-ca.crt` path and the
+Kubernetes driver key. Before sandbox creation, the in-process driver GETs one
+deterministically named normalized `ca.crt` ConfigMap,
+`openshell-network-additional-ca-<gateway-id>`, in the selected shared,
+managed, or operator namespace. It creates the object when absent, handles a
+create conflict by rereading it, and accepts an existing object only when both
+`openshell.ai/managed-by=openshell` and the matching
+`openshell.ai/gateway-id` labels are present. Only after that check does it use
+forced server-side apply, allowing a restarted same-owner gateway to replace a
+stale field manager's data while never adopting a foreign object. The normalized
+PEM is bounded below Kubernetes's 1 MiB ConfigMap limit.
+
+Combined topology mounts it only in the agent container that runs network
+supervision. Sidecar topology mounts it only in `openshell-network`; workload
+and init containers do not receive it. Both use the read-only
+`/etc/openshell-tls/network-additional-ca.crt` path and the
 `--network-additional-ca-bundle` argument. This material augments destination
 trust and remains separate from callback mTLS Secrets and corporate-proxy trust.
-Running supervisors load it only at startup.
+Running supervisors load it only at startup. When the global setting is removed,
+newly created or recreated pods receive no ConfigMap volume or mount; existing
+supervisors retain their startup material until restarted. The driver
+intentionally has no list/delete permission, so unused managed ConfigMaps can
+remain. After verifying no sandbox uses it, an operator can identify the exact
+name plus the managed-by and gateway-id labels and delete that named ConfigMap
+from the relevant namespace.
 
 The driver forwards the canonical main-process specification to the process
 supervisor and sets pod `restartPolicy: Never`. Main-process environment